Bug Circuit

For startups and fintechs

API penetration testing, done by hand.

A person tests your API and writes a report you can hand to a bank, partner or auditor. The API behind your own web app is included from $49. A standalone API gets a fixed quote before testing starts.

By the Bug Circuit security team · Last updated

Who can do an affordable API penetration test? Bug Circuit tests APIs by hand at published prices. If the API is the one your web app calls, it is covered by the $49 one-time audit (Circuit) or by Signal at $147 every 3 months, which adds fixes and re-tests. A standalone API, such as a backend used by partners, mobile apps or a bank, is scoped as Enterprise and gets a fixed quote before testing starts. Either way you get a written report with every finding, its severity, evidence and the exact fix.
Which option fits your API
Circuit: $49 onceSignal: $147 / 3 monthsEnterprise: fixed quote
The API your own web app callsIncludedIncludedIncluded
A standalone API used by other systemsNot includedNot includedIncluded
Only the endpoints you chooseNot includedNot includedIncluded
Written reportIncludedIncludedIncluded
Help fixing high and critical issuesNot includedIncludedAgreed in the quote
Re-testsNot includedEvery 6 monthsAgreed in the quote

What we test in an API

The OWASP API Security Top 10 is the usual checklist of the most common API risks. A manual test goes further, because the worst API bugs are in your own rules.

  • Access between accounts: changing an ID in a request to read or change another customer’s data.
  • Authentication and tokens: how keys and tokens are issued, checked, expired and revoked.
  • Roles and permissions: whether a normal user can call admin-only endpoints.
  • Business logic: changing an amount, repeating a transfer, or skipping a step in a flow.
  • Rate limits: whether money-moving and login endpoints can be hammered.
  • Input handling: injection and unsafe data in requests and responses.
  • Webhooks and API keys: unsigned callbacks and keys that are exposed or too powerful.

Building on a bank or payment API?

Fintech startups are often asked for a VAPT report by a partner bank before going live. The endpoints that talk to the bank are usually the right place to start. Tell us which ones they are, and how they are used, and we will scope the test around them. See what a VAPT report can and cannot prove before you commit, and show the sample report to whoever asked for it.

From scope to report

  1. 1

    Tell us the scope

    The endpoints, how they are used, and who needs the report.

  2. 2

    Get a fixed quote

    For a standalone API. The API behind your web app is already covered by a plan.

  3. 3

    Verify and authorize

    Prove you own the domain and sign the Authorization to Test.

  4. 4

    We test by hand

    A security engineer works through your API with real test accounts.

  5. 5

    You get the report

    Every finding with severity, evidence and the fix.

What the evidence says

OWASP ranks Broken Object Level Authorization first among API risks, and says: “Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.” Source: OWASP API Security Top 10 (2023).

Frequently asked questions

Do you test an API on its own, with no website?
Yes. A backend API that other systems use, such as a partner, mobile or bank-facing API, is scoped as Enterprise. You tell us the endpoints and how they are used, and you get a fixed quote before any testing starts.
How much does an API penetration test cost?
If the API is the one your own web app calls, it is part of testing that app: $49 one-time with Circuit, or $147 every 3 months with Signal, which adds fixes and re-tests. A standalone API is priced after a short scoping chat, based on how many endpoints are in scope and how they are used.
Can we test only the endpoints that matter?
Yes, on a scoped engagement. Many startups test the endpoints that move money or touch a partner bank first. The report states exactly which endpoints were in scope, so a reader can see what was and was not covered.
What do you need from us?
A list of the endpoints in scope, API documentation or a Postman or OpenAPI file if you have one, test credentials for each role, and the environment to test. You also verify you own the domain and sign an Authorization to Test. Nothing starts before that.
Do you test production or staging?
Either. Many teams point us at a staging environment that mirrors production. If staging and production are both in scope, that is scoped as Enterprise.
Is the report a compliance certificate?
No. It is evidence of testing, written by an independent tester, that you can give to an auditor, a bank or a partner. We do not issue compliance certificates. If a partner has its own requirements, send them our sample report first.
How is this different from an API scanner?
A scanner checks for known patterns. It cannot tell that user A should not be able to read user B's records, or that a transfer amount can be changed in the request. A person tests that logic by hand with real accounts.

Keep reading

EnterpriseSend your scope and get a fixed quote.VAPT report for complianceWhat banks, auditors and tenders actually accept.Pentesting for SaaS, fintech and healthcareWhat regulated startups need to test.Sample reportExactly what you receive.Answering a security questionnaireHow to reply without a security team.Penetration testing before SOC 2When to test and what the auditor looks for.SOC 2 penetration testingA manual pentest and a report for your auditor.Free tool: security.txt GeneratorBuild a valid RFC 9116 security.txt so researchers know how to report a bug to you.

Start with the free check

See your public attack surface in seconds, then talk to us about your API.

Ready for the full manual audit? See pricing